The browser padlock: what HTTPS guarantees and what it doesn't

For years we were taught a simple rule: “if you see the padlock, the page is safe”.

The rule was poor then and it’s actively dangerous now. Fraudulent sites have padlocks too — the vast majority of them, in fact, because getting one is free and automatic.

The padlock does mean something important. But it means one very specific thing, and it isn’t “this website is trustworthy”.

What HTTPS guarantees

Three things, and no more:

That nobody can read what you send along the way. Your password, card number, whatever you type into a form: it travels encrypted. Not your ISP, not the owner of the café Wi-Fi, not anyone intercepting the traffic can see the content.

That nobody can modify it along the way. If someone alters a single byte, the browser detects it and drops the connection. Before HTTPS it was common for some providers to inject advertising into the pages they served.

That you’re talking to the server for the domain shown in the address bar. If it says mybank.com, the certificate proves that server controls mybank.com.

That last line is the one to read carefully.

What it doesn’t guarantee

It doesn’t say the site is honest. A certificate proves control of a domain, not the intentions of whoever controls it. A fraudulent shop can get a valid certificate for its domain in five minutes at no cost.

It doesn’t say the domain is the one you think. This is the trick behind nearly every scam. mybank-secure.com, my-bank.com or mybank.com.account-verify.net can all carry a perfectly valid padlock. The padlock confirms you’re talking to that domain; not that the domain is your bank.

It says nothing about what happens afterwards. The data arrives encrypted at the server. What the server does with it — store it in the clear, sell it, lose it in a breach — is entirely outside what HTTPS covers.

It doesn’t hide where you’re going. The content is encrypted, but the domain name is visible to your internet provider. They know you visited a site; not what you did inside.

Why the landscape changed

Until 2015 a certificate cost money and had to be renewed by hand. That meant many small legitimate sites didn’t have one, and fraudulent sites didn’t bother either. In that context the padlock genuinely was a rough signal of seriousness.

Then Let’s Encrypt arrived, a free and automated certificate authority. It was excellent news: today practically the whole web is encrypted, as it should be.

But it had a side effect. By becoming free and automatic for everyone, the padlock stopped distinguishing good sites from bad ones. Today the overwhelming majority of phishing pages have one.

The advice “look for the padlock” became obsolete and nobody updated it.

What to look at instead

The domain, read right to left. This is the part almost nobody knows. In an address, the real domain is what sits immediately before the first slash:

https://mybank.com.verification.net/login
                        ↑
                 the real domain is verification.net

Everything before that is subdomains, which anyone can invent. Find the first slash, walk back to the previous dot, and that’s who you’re actually talking to.

How you got there. A link in an email or text is the usual route for fraud. If the message rushes you — “your account will be blocked in 24 hours” — the urgency is part of the method. Type the address yourself or use your own bookmark.

Lookalike characters. Domains exist that use letters from other alphabets visually identical to Latin ones. Modern browsers warn about this, but not always.

Coherence. Spelling errors, a design that’s nearly identical but odd in places, an unusual payment method, impossible prices.

The warnings that do matter

When the browser says “Your connection is not private” or “Invalid certificate”, listen. That isn’t the case of an unencrypted site: it’s encryption that’s failing, and the possible causes include someone intercepting the connection.

The innocent exception is the date: if your computer’s clock is wrong, every certificate looks expired. Worth checking before panicking.

Never click “proceed anyway” on a page where you’ll type a password or pay.

What disappeared, and why

You may remember green bars showing a company name. Those were extended validation certificates, which required verifying the organisation’s legal existence.

Browsers retired them around 2019. The reason was practical: studies showed users didn’t look at them, and it was possible to register companies with confusing names to obtain one. A signal nobody checks and that can be imitated isn’t a security signal.

In one sentence

HTTPS protects the road, not the destination.

It guarantees that what you send arrives intact and in secret at the server for that domain. It has no opinion on whether that server deserves your data. That judgement is still yours, and it starts with reading the domain carefully.